At Smoothwall we're doing a lot of work to get our customers ready for GDPR. We are working closely with our lawyers to determine what needs to be done in the areas of filtering and monitoring.
On the issue of consent our understanding is that if you have decided that one of the conditions in Article 6(1) or Article 9(2), other than those which are consent-based, apply to your processing of personal data then you will not need to obtain consent.
You may decide that the appropriate conditions for your processing of filtering are one or more of:
· Article 6(1)© – compliance with a legal obligation which you are subject to
· Article 6(1)(e) – performance of a task in the public interest
Retention is not an issue as long as you make a declaration on what retention period you are working to.
The right to erasure or the right to be forgotten, as it is also known, is not an absolute right. As a data controller, you will need to consider each request on an individual basis to determine what, if any, personal data relating to the individual making the request, needs to be deleted.